SHA Hash Digest

Compute SHA-1 / SHA-256 / SHA-384 / SHA-512 digests via the Web Crypto API.

What this tool does

The SHA family (SHA-1, SHA-256, SHA-384, SHA-512) maps any input to a fixed-length digest; the number is the output length in bits, and more bits mean stronger collision resistance. This tool uses the browser's built-in Web Crypto API — the same implementations behind OS-level crypto — so results match the command-line shasum exactly, all computed locally.

Typical use cases

SHA-256 is today's default: Git is migrating from SHA-1 to SHA-256 for commit IDs; certificate fingerprints, download verification, and blockchain addresses use it; front-end developers put Subresource Integrity attributes (integrity="sha256-...") on script and link tags so a compromised CDN cannot inject malicious code. SHA-512 appears inside signature schemes and protocols.

Caveats

SHA-1 was practically broken in 2017 when Google's SHAttered attack produced two colliding PDFs; browsers and certificate authorities have abandoned it. Use SHA-256 or better for anything security-relevant, and keep SHA-1 only for legacy, non-security compatibility. Also distinguish hashing from password hashing: even SHA-256 is wrong for password storage because it is fast and unsalted — always use bcrypt or Argon2 with a salt for passwords.